wherein the scanning the decoded macro [to determine whether it includes a 
virus] comprises: 

determining whether the decoded macro includes a first portion which 
corresponds to the first suspect instruction identifier; 

determining whether the decoded macro includes a second portion 
which corresponds to the second suspect instruction identifier; 

determining that the decoded macro includes the virus if the decoded 
macro includes the first and second portions; and 

wherein the first suspect instruction identifier [detects] identifies a macro virus 
enablement instruction. 



2. (Amended) The method of claim 1, further comprising: 

removing the virus from the macro to produce a treated macro if the [step of] 
scanning the decoded macro indicates that the macro is infected with the virus. 




(Amended) The method of claim j£ 9 wherein the [step of] removing the first 
suspect macro instruction includes replacing the first suspect instruction with a benign 
instruction. 



7 



virus 



yC. (Amended) The method of claim^ wherein the [step of] removing the 
comprises: 

locating a second suspect macro instruction in the decoded macro which 
corresponds to the second suspect instruction identifier; and 

removing the second suspect macro instruction from the decoded macro to 
produce a treated macro. 
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Ja. (Amended) In a computer system comprising a processor and a memory, 
method for detecting viruses in macros, the method comprising: 

obtaining comparison data including information for detecting a virus; 
retrieving a macro; 

decoding the macro to produce a decoded macro; 
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scanning the decoded macro for a virus by comparing the decoded macro to the 
comparison data; 

wherein the comparison data includes a first suspect instruction identifier and a 
second suspect instruction identifiers; and 

wherein a first set of respective first and second suspect instruction identifiers 
comprises the strings 73 CB 00 0C 6C 01 00 and 67 C2 80. 



J4. (Amended) The method of claim ^ wherein a second set of respective first 
and second suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 64 
6F 02 67 DE 00 73 87 01 12 73 7F, a third set of respective first and second suspect 
instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 6D 61 63 72 6F 73 76 
08, a fourth set of respective first and second suspect instruction identifiers comprises the 
strings 12 6C 01 00 and 64 67 C2 80 6 A OF 47, and a fifth set of respective first and second 
suspect instruction identifiers comprises the strings 79 7C 66 6F 72 6D 61 74 20 63 6 A and 
80 05 6A 07 43 4F 4D. 



JO 

(Amended) In a computer system comprising a processor and a memory, a 
method for detecting viruses in macros, the method comprising: 
retrieving a macro; 

obtaining comparison data for detecting a virus, the comparison data including 
a first suspect instruction identifier and a second suspect instruction identifier; 

scanning the macro to determine whether the macro includes a first portion 
which corresponds to the first suspect instruction identifier; 

scanning the macro to determine whether the macro includes a second portion 
which corresponds to the second suspect instruction identifier; and 

determining that the macro is infected with the virus if the macro includes the 
first and second portions; 

wherein the first suspect instruction identifier includes the string 73 CB 00 0C 
6C 01 00 and the second suspect instruction identifier includes the string 67 C2 80. 
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J/7. (Amended) The method of claim ]4, wherein the [step of] treating the 



macro 



comprises: 
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locating a first macro instruction in the infected macro which corresponds to 
the first suspect instruction identifier; and 

removing the first macro instruction from the infected macro to repair the 
infected macro. 

(Amended) The method of claim yi, wherein the [step of] treating the macro 

comprises: 

locating a second macro instruction in the infected macro which corresponds to 
the second suspect instruction identifier; and 

removing the second macro instruction from the infected macro to repair the 
infected macro. 

(Amended) The method of claim \0 9 wherein the [step of] retrieving a macro 

comprises: 

accessing a targeted file; and 

determining whether the targeted file is a template file; 
if the file is not a template file, determining whether the targeted file includes 
an embedded macro; and 

if the file includes an embedded macro, locating the embedded macro. 
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2%. (Amended) In a computer system comprising a processor and a memory, a 
method for detecting viruses in macros, the method comprising: 
retrieving a macro; 

obtaining comparison data for detecting a virus, the comparison data including 
a first suspect instruction identifier and a second suspect instruction identifier; 

scanning the macro to determine whether the macro includes a first portion 
which corresponds to the first suspect instruction identifier; 

scanning the macro to determine whether the macro includes a second portion 
which corresponds to the second suspect instruction identifier; 

determining that the macro is infected with the virus if the macro includes the 
first and second portions, 
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wherein the comparison data includes a plurality of sets of respective first and 
second suspect instruction identifiers; and 

wherein a first set of suspect instruction identifiers comprises the strings 73 CB 
00 0C 6C 01 00 and 67 C2 80, a second set of suspect instruction comprises the strings 
73 CB 00 0C 6C 01 00 and 64 6F 02 67 DE 00 73 87 01 12 73 7F, a third set of 
suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 6D 61 
63 72 6F 73 76 08, a fourth set of suspect instruction identifiers comprises the strings 
12 6C 01 00 and 64 67 C2 80 6A OF 47, and a fifth set of suspect instruction 
identifiers comprises the strings 79 7C 66 6F 72 6D 61 74 20 63 6A and 80 05 6 A 07 
43 4F 4D. 



(Amended) An apparatus for detecting viruses in macros, the apparatus 
comprising: 

a virus information module, for storing comparison data for detecting a virus, 
the comparison data including a first suspect instruction identifier and a second 
suspect instruction identifier; and 

a macro virus scanning module, in communication with the virus information 
module, for receiving the comparison data and scanning a macro to determine whether 
the macro includes a first portion which corresponds to the first suspect instruction 
identifier and a second portion which corresponds to the second suspect instruction 
identifier; 

wherein the comparison data includes a plurality of sets of respective first and 
second suspect instruction identifiers; and 

wherein a first set of suspect instruction identifiers comprises the strings 73 
CB 00 0C 6C 01 00 and 67 C2 80, a second set of suspect instruction comprises the 
strings 73 CB 00 0C 6C 01 00 and 64 6F 02 67 DE 00 73 87 01 12 73 7F, a third set of 
suspect instruction identifiers comprises the strings 73 CB 00 0C 6C 01 00 and 6D 61 
63 72 6F 73 76 08, a fourth set of suspect instruction identifiers comprises the strings 
12 6C 01 00 and 64 67 C2 80 6A OF 47, and a fifth set of suspect instruction 
identifiers comprises the strings 79 7C 66 6F 72 6D 61 74 20 63 6 A and 80 05 6 A 07 
43 4F 4D. 
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